[FuzzMutate] Inst deleter doesn't work with PhiNodes

[igor-laevsky]

Summary

Currently InstDeleter is going to crash when trying to delete phi node. I figured we might as well just restrict this transformation to avoid unnecessary crashes during continuous runs. I also restricted removal of couple of other instruction which InstDeleter will probably fail on.

[bogner]

LGTM

lib/FuzzMutate/IRMutator.cpp

uint64_t InstDeleterIRStrategy::getWeight(size_t CurrentSize, size_t MaxSize,
   // Clamp negative weights to zero.
   if (Line < 0)
     return 0;
   return Line;
 }
 
 void InstDeleterIRStrategy::mutate(Function &F, RandomIRBuilder &IB) {
   auto RS = makeSampler<Instruction *>(IB.Rand);
-  // Avoid terminators so we don't have to worry about keeping the CFG coherent.
-  for (Instruction &Inst : instructions(F))
-    if (!Inst.isTerminator())
-      RS.sample(&Inst, /*Weight=*/1);
+  for (Instruction &Inst : instructions(F)) {
+    // TODO: We can't handle these instructions.
+    if (Inst.isTerminator() || Inst.isEHPad() ||
+        Inst.isSwiftError() || isa<PHINode>(Inst))
+      continue;
+
+  }
   if (RS.isEmpty())
     return;
 
   DEBUG(dbgs() << "[FuzzMutate] Running instruction deleter on function: ");
   DEBUG(F.dump());
 
   DEBUG(dbgs() << "[FuzzMutate] Deleting instruction: ");
   DEBUG(RS.getSelection()->dump());
for (auto I = BB->getFirstInsertionPt(), E = Inst.getIterator(); I != E;
     if (Pred.matches({}, &*I))
       RS.sample(&*I, /*Weight=*/1);
     InstsBefore.push_back(&*I);
   }
   if (!RS)
     RS.sample(IB.newSource(*BB, InstsBefore, {}, Pred), /*Weight=*/1);
 
   Inst.replaceAllUsesWith(RS.getSelection());
+  Inst.eraseFromParent();
 }

unittests/FuzzMutate/StrategiesTest.cpp

std::unique_ptr<Module> parseAssembly(
   std::string ErrMsg;
   raw_string_ostream OS(ErrMsg);
   Error.print("", OS);
 
   assert(M && !verifyModule(*M, &errs()));
   return M;
 }
 
+void IterateOnSource(StringRef Source, IRMutator &Mutator) {
+  LLVMContext Ctx;
+
+  for (int i = 0; i < 10; ++i) {
+    auto M = parseAssembly(Source.data(), Ctx);
+    ASSERT_TRUE(M && !verifyModule(*M, &errs()));
+
+    Mutator.mutateModule(*M, Seed, Source.size(), Source.size() + 100);
+    EXPECT_TRUE(!verifyModule(*M, &errs()));
+  }
+}
+
 TEST(InjectorIRStrategyTest, EmptyModule) {
   // Test that we can inject into empty module
 
   LLVMContext Ctx;
   auto M = llvm::make_unique<Module>("M", Ctx);
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
 
   auto Mutator = createInjectorMutator();
   ASSERT_TRUE(Mutator);
 
   Mutator->mutateModule(*M, Seed, 1, 1);
   EXPECT_TRUE(!verifyModule(*M, &errs()));
 }
 
 TEST(InstDeleterIRStrategyTest, EmptyFunction) {
   // Test that we don't crash even if we can't remove from one of the functions.
 
-  LLVMContext Ctx;
   StringRef Source = ""
       "define <8 x i32> @func1() {\n"
         "ret <8 x i32> undef\n"
       "}\n"
       "\n"
       "define i32 @func2() {\n"
         "%A9 = alloca i32\n"
         "%L6 = load i32, i32* %A9\n"
         "ret i32 %L6\n"
       "}\n";
 
   auto Mutator = createDeleterMutator();
   ASSERT_TRUE(Mutator);
 
-  // We need to choose 'func1' in order for the crash to appear.
-  // Loop 10 times and assume we are lucky.
-  for (int i = 0; i < 10; ++i) {
-    auto M = parseAssembly(Source.data(), Ctx);
-    ASSERT_TRUE(M && !verifyModule(*M, &errs()));
-
-    Mutator->mutateModule(*M, Seed, Source.size(), Source.size() + 100);
-    EXPECT_TRUE(!verifyModule(*M, &errs()));
-  }
+  IterateOnSource(Source, *Mutator);
+
+TEST(InstDeleterIRStrategyTest, PhiNodes) {
+  // Test that inst deleter works correctly with the phi nodes.
+
+  LLVMContext Ctx;
+  StringRef Source = "\n\
+      define i32 @earlyreturncrash(i32 %x) {\n\
+      entry:\n\
+        switch i32 %x, label %sw.epilog [\n\
+          i32 1, label %sw.bb1\n\
+        ]\n\
+      \n\
+      sw.bb1:\n\
+        br label %sw.epilog\n\
+      \n\
+      sw.epilog:\n\
+        %a.0 = phi i32 [ 7, %entry ],  [ 9, %sw.bb1 ]\n\
+        %b.0 = phi i32 [ 10, %entry ], [ 4, %sw.bb1 ]\n\
+        ret i32 %a.0\n\
+      }";
+
+  auto Mutator = createDeleterMutator();
+  ASSERT_TRUE(Mutator);
+
+  IterateOnSource(Source, *Mutator);
 }
 
 }